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Amendments to the Claims (this listing replaces all prior versions): 

1 . (currently amended) A method for detecting intrusion in a database managed by an 
access control system, comprising: 

defining at least one intrusion detection profile, each profile including a set of item access 
rates, one of which includes a definition of a number of rows that may be accessed in a 
predetermined period of time; 

associating each user with one of said defined profiles; 

receiving a database query from a user; 

determining that execution of said query causes said user to exceed an item access 
[[rates]] rate defined in the profile associated with said user; and 

notifying the access control system to alter user authorization, thereby preventing the 
result of the query from being transmitted to the user. 

2. (previously presented) The method of claim 1, further comprising: 
accumulating results from performed queries in a record; and 

determining whether the accumulated results exceed a member of said set of item access 

rates. 

3. (previously presented) The method of claim 1, further comprising marking an item 
subject to a member of said set of item access rates . 

4. (previously presented) The method of claim 3, wherein said step of determining 
includes determining if the query result includes a marked item , and proceeding with the 
intrusion detection process only upon determining that said member of said set of item access 
rates is exceeded. 

5. (previously presented) The method of claim 1, wherein a member of said set of item 
access rates defines the number of rows a user may access from a database item at one time. 

6. (previously presented) The method of claim 1, wherein a member of said set of item 
access rates defines the number of rows a group of users may access from a database item at one 
time. 
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7. (previously presented) The method of claim 1, wherein a member of said set of item 
access rates defines the number of rows that may be accessed from a database item over a period 
of time. 

8. (previously presented) The method of claim 1, wherein a member of said set of item 
access rates defines the number of rows a group of users may access from a database item over a 
period of time. 

9. (previously presented) The method of claim 1, wherein the intrusion detection policy 
further includes at least one inference pattern, the method further comprising: 

accumulating results from performed queries in a record; 

comparing said record with said at least one inference pattern , in order to determine 
whether a combination of accesses in said record match said inference policy; and 

notifying the access control system, upon determining that a combination of accesses in 
the record match said inference policy, to alter the user authorization, thereby preventing the 
result of the query from being transmitted to the user. 

10-11. (canceled) 

12. (previously presented) The method of claim 1, further comprising executing said 

query. 

13. (previously presented) The method of claim 1, further comprising attaching a trigger 
to items subject to item access rates, said trigger triggering said step of determining. 



